CVE-2025-59343: mafintosh tar-fs Path Traversal
CVSS: 8.7v4.0HighDeferred
AliasesUBUNTU-CVE-2025-59343DEBIAN-CVE-2025-59343DLA-4313-1DSA-6013-1CGA-4w5g-7hcj-xc4mCGA-5hvc-h8hm-4fvxCGA-6524-qq6p-6hr4CGA-6gp7-2fjr-5qrpCGA-9m85-p3v8-29h8CGA-h28x-3rx2-543fCGA-h4gc-xx9h-g63jCGA-j25w-pf4q-8m75CGA-qg2f-946x-6wfwCGA-vvhh-mgwr-v2h5CGA-w5gq-9794-8c3pCGA-wmh2-2699-gxqxGHSA-vj76-c3g6-qr5vCGA-24pj-j6jm-hrwwCGA-29xr-h2qv-ffh8CGA-2cpc-jrf8-2hr2CGA-2f6v-37c5-6mfgCGA-2h43-2qj8-qccxCGA-2h4r-fr4c-3qp5CGA-2wjq-88w3-q42fCGA-3222-jc4c-qgv8CGA-34rm-28rj-gx9pCGA-38v6-mgf4-f43fCGA-3c4v-523w-3f69CGA-3p66-vfq3-6m2qCGA-3w84-3frv-6gxgCGA-4259-wr96-vwcxCGA-436p-hccr-j87pCGA-476v-c5ff-wmqvCGA-4c39-72c4-p4ffCGA-4c7x-m7mv-c992CGA-4m9v-9vh3-3g5wCGA-56x5-p9gc-7qcjCGA-5f94-w2rg-9xv5CGA-5pph-8rc6-hxrxCGA-5rw3-9xcg-x8ggCGA-5x93-f94c-xcf3CGA-68vp-2qvg-h6m8CGA-6jjv-jw4p-gg74CGA-729q-g729-jhh5CGA-77qp-c238-c7r2CGA-788f-m6xr-vrv2CGA-7c7j-p8gv-cgwhCGA-7jcx-8727-rf4vCGA-7w88-9582-jwrqCGA-82vm-834p-fh64CGA-86mx-g7h6-226fCGA-88xg-8h7h-9mchCGA-89vx-p934-wh65CGA-8j5p-xhh8-fp47CGA-8qmc-x6v4-9cqrCGA-8xq9-p8gx-m89rCGA-99f5-7c34-288vCGA-9j52-xc59-8rqcCGA-9qq2-m745-gcf8CGA-9r2v-h2gw-frf8CGA-9v8c-xrj9-762mCGA-9wx7-35hh-4xmgCGA-9xvw-cw8j-pjh3CGA-c679-4w7p-x352CGA-c7jf-ffgm-pf79CGA-c923-xrgm-vq6fCGA-cfg8-r649-8852CGA-cgc9-f235-w7wmCGA-cm6p-2jjg-w7c3CGA-cmvq-3v9x-mcv6CGA-cmwf-g5q5-8xjpCGA-cwc4-2p9v-33pqCGA-f23c-6wvw-788wCGA-f9m7-73m6-wx87CGA-fmv6-8crg-pff7CGA-fpgf-gq23-mg3wCGA-fqhr-95pw-jcm4CGA-frff-g7qw-vxghCGA-fw6c-fwxq-964jCGA-g39v-g525-x2rgCGA-ghgq-mrf6-2crgCGA-gvf8-66j3-4g9qCGA-h67r-grcc-57hpCGA-h86g-m5gp-qf69CGA-h89c-v3m3-vc8mCGA-h8hw-r3fm-v4jwCGA-hc8g-759p-gx53CGA-hcq4-q53m-rjrvCGA-hgmq-8qr4-67q5CGA-hh46-p9cw-mm82CGA-hh73-5qvq-9q33CGA-hm74-j6w6-36w7CGA-hp6f-2v5g-xp8vCGA-hrfc-g76g-crq8CGA-j4h6-jc46-q9qjCGA-j4h7-hqw2-9hj4CGA-jcqj-5v85-qr52CGA-jg5v-v744-2p34CGA-jg5x-j6vf-f33qCGA-jh6w-299h-ccw7CGA-jqj2-95mv-x53hCGA-jvm7-2mjx-28g3CGA-m5r9-r83x-4ch6CGA-mgrv-cp49-hrx3CGA-p2pf-68mv-m9h8CGA-p7pp-wmcp-p5hgCGA-p8fj-fvwx-cvq2CGA-pcp8-xpv8-3x9mCGA-pcvq-mxvg-4mw3CGA-q5h7-8987-52q8CGA-qc82-c6vv-49r4CGA-qq2g-7c8f-2h46CGA-r54w-j7p4-qhf2CGA-rhrf-9m7p-cr57CGA-rrg3-2mm7-hwp5CGA-rrmv-2ff9-8jjcCGA-rv4p-wmh3-3jccCGA-v6qj-4pxv-wjchCGA-vccw-8cr6-h9p2CGA-vcgg-6rgh-f32gCGA-vfjq-665x-jvv7CGA-vmjc-4mqx-w392CGA-vmjw-wmrq-9cr2CGA-vp3p-hv48-gq5wCGA-vvrm-x2qj-58c9CGA-vvv2-mcww-5fvxCGA-w2vj-5chq-x8mvCGA-w52j-j45x-f6vcCGA-x93x-w2wf-279m
Published 24-09-2025Last modified 03-11-2025
Vulnerability summary
CVE-2025-59343 is a high (CVSS 8.7) Path Traversal vulnerability in mafintosh tar-fs. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45% of scored vulnerabilities.
CVSS score
8.7/10
010
High · v4.0 (CVE.org)EPSS score
0.55%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 9Timeline
- 24-09-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.55% on 19-09-2026
19-09-202619-10-2026
EPSS score0.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-61UNIX Symbolic Link (Symlink) FollowingThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Affected systems
Chainguard46 products
- code-server< 4.105.1-r1
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
- gitlab-rails-ce-18.5All versions (No fix recorded)
Wolfi6 products
- code-server< 4.105.1-r1
- grafana-image-renderer< 4.0.15-r2
- sqlpad< 7.5.7-r1
- sqlpad-compat< 7.5.7-r1
- tileserver-gl< 5.4.0-r2
Debian1 product
- node-tar-fs< 3.0.9+~cs2.0.4-2 | < 2.1.3-0+deb12u2 | < 3.0.9+~cs2.0.4-1+deb13u1 | < 2.1.3-0+deb11u2
Mafintosh1 product
- tar-fs≥ 3.0.0, < 3.1.1 | ≥ 2.0.0, < 2.1.3 | < 1.16.5
Npm1 product
- tar-fs≥ 3.0.0, < 3.1.1 | ≥ 2.0.0, < 2.1.4 | < 1.16.6
Ubuntu1 product
- node-tar-fs< 2.1.1-6ubuntu0.22.04.1~esm1 | < 2.1.1-6ubuntu0.24.04.1~esm1 | < 3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1
6 vendors · 56 products
References
10 links- github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5vX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09X Refsource MISCREPORTFIXWEB
- github.com/mafintosh/tar-fsPACKAGE